Commit a07211e3 authored by Pavel Begunkov's avatar Pavel Begunkov Committed by Jens Axboe
Browse files

io_uring: don't touch scm_fp_list after queueing skb 



It's safer to not touch scm_fp_list after we queued an skb to which it
was assigned, there might be races lurking if we screw subtle sync
guarantees on the io_uring side.

Fixes: 6b06314c ("io_uring: add file set registration")
Signed-off-by: default avatarPavel Begunkov <asml.silence@gmail.com>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 34bb7718

fs/io_uring.c

+6 −2
Original line number Diff line number Diff line
@@ -8631,8 +8631,12 @@ static int __io_sqe_files_scm(struct io_ring_ctx *ctx, int nr, int offset) 
		refcount_add(skb->truesize, &sk->sk_wmem_alloc);

		skb_queue_head(&sk->sk_receive_queue, skb);



		for (i = 0; i < nr_files; i++)

			fput(fpl->fp[i]);

		for (i = 0; i < nr; i++) {

			struct file *file = io_file_from_index(ctx, i + offset);



			if (file)

				fput(file);

		}

	} else {

		kfree_skb(skb);

		free_uid(fpl->user);